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Introduction 


The Information Commissioner is producing a direct marketing code 
of practice, as required by the Data Protection Act 2018. A draft of 
the code is now out for public consultation. 


The draft code of practice aims to provide practical guidance and 
promote good practice in regard to processing for direct marketing 
purposes in compliance with data protection and e-privacy rules. 
The draft code takes a life-cycle approach to direct marketing. It 
starts with a section looking at the definition of direct marketing to 
help you decide if the code applies to you, before moving on to 
cover areas such as planning your marketing, collecting data, 
delivering your marketing messages and individuals rights. 


The public consultation on the draft code will remain open until 4 
March 2020.The Information Commissioner welcomes feedback on 
the specific questions set out below. 


You can email your response to directmarketingcode@ico.org.uk 


Or print and post to: 


Direct Marketing Code Consultation Team 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the consultation, please 
email the Direct Marketing Code team. 


Privacy statement 


For this consultation we will publish all responses received from 
organisations except for those where the response indicates that they 
are an individual acting in a private capacity (eg a member of the 
public). All responses from organisations and individuals acting in a 
professional capacity (eg sole traders, academics etc) will be published 
but any personal data will be removed before publication (including 
email addresses and telephone numbers). 


For more information about what we do with personal data please see 
our privacy notice 


Q1 Is the draft code clear and easy to understand? 


Yes 
X No 


If no please explain why and how we could improve this: 


In general, we find that the draft code is not difficult to read, however it is still leaves 
areas of ambiguity which in turn leads to confusion. This is particularly the case where 
words such as “unlikely” or “very difficult” are used which are leaning towards an action 
or activity being outside of the ICO’s interpretation of the law, however there is no 
guidance as to when these activities are or could be acceptable. If there are no examples, 
then these actions could be more clearly outlined. 


When we explore the areas around notification of individuals when their data is obtained 
via third parties additional examples around the exceptions would be useful particularly 
where the Commissioner views them as non-controversial such data obtained for the 
purposes of marketing suppression and/or data quality purposes (i.e. deceased, 
goneaway lists, etc.). 


Q2 Does the draft code contain the right level of detail? (When 
answering please remember that the code does not seek to 
duplicate all our existing data protection and e-privacy guidance) 


O Yes 
Kl No 
If no please explain what changes or improvements you would like to 


see? 


Not in all places, the examples don’t always have the level of complexity of real-world 
cases, assuming very traditional Controller and Processor roles. The examples are often 
of organisation and the impact on the consumer, further details on the processing that 
occurs within the supply chain would be useful particularly as the scope and coverage of 
the Code of Practice has been stretched to bring more areas of the supply chain under its 
purview. This particularly is in focus with the concentration on consent as an appropriate 
legal basis. More clarity and examples on how the Commissioner would view the 
capturing of consents for more complex processing activities would be of significant aid. 


Q3 Does the draft code cover the right issues about direct marketing? 


Yes 
X No 


If no please outline what additional areas you would like to see 
covered: 


Broadly, this guidance covers the main areas of Direct Marketing however channels which 
are still important to many advertisers such as postal marketing is significantly 
underserviced with guidance and information limited and seems to focus more on the 
difference between door drops and addressed mail. Further to this it offers no guidance 
around the most appropriate legal basis and the challenges that maybe in faced by an 
organisation between prospecting and warm marketing as well as the processing attached 
to these campaigns. 


The profiling and enrichment of data is an area which is fairly light on guidance, further 
examples with regards to what could be classed as “intrusive profiling” would be of 
significant benefit and would assist organisation in assessing risk in a manner which 
aligns with that of the Commissioners view. 


Q4 Does the draft code address the areas of data protection and e- 
privacy that are having an impact on your organisation’s direct 
marketing practices? 


O Yes 


X No 


If no please outline what additional areas you would like to see covered 


In general the code feels like it is written for controllers which we understand are core 
actors in these processes, however details on areas which are often undertaken by 
Processors on behalf of Controllers would add significant clarity to further parts of the 
supply chain which play key parts in the Direct Marketing process but are not referred to 
within this code. 


More details around cookies and other technology would be a tremendous boost to this 
code, particularly around RTB, adtech and in app advertising. The use of cookies other 
technology now more than ever linked to direct marketing and these areas feel light in 
terms of the how the Commissioner is applying the regulations to these areas. 


Running through a Direct Marketing Campaign as an example would be of significant use 
in this area, particularly one per main channel would assist no end in creating a flow and 
helping organisations identify how the Commissioner would approach a fictious campaign. 


Q5 Is it easy to find information in the draft code? 


X Yes 


Ll No 
If no, please provide your suggestions on how the structure could be 


improved: 


In general, we feel that it isn’t difficult to find information within this code. An increased 
glossary would further assist this and it would insure that we are using the same 
terminology as the Commission and misinterpretation are less likely to occur. 


Q6 Do you have any examples of direct marketing in practice, good or bad, 
that you think it would be useful to include in the code 


0O Yes 
X No 
If yes, please provide your direct marketing examples : 


Q7 Do you have any other suggestions for the direct marketing code? 


More clarity and straightforwardness. The table which demonstrates what activities 
require consent under PECR, for example, is a good example of visually demonstrating 
and summarizing various scenarios. If this approach were to be applied to other areas of 
the code it would help with its understanding and ensuring that all readers have 
interpreted it the same way, as opposed to leaving room for misinterpretation. 


Avoiding the use of ambiguous language such as unlikely, we would prefer that the 
Commissioner outlined the exceptions to the rule rather than leaving it unclear. 


About you 


Q8 Are you answering as: 


An individual acting in a private capacity (eg someone 
providing their views as a member of the public) 

An individual acting in a professional capacity 

On behalf of an organisation 

Other 


Please specify the name of your organisation: 


EVEVE O 


Edit 


If other please specify: 


Q9 How did you find out about this survey? 


ICO Twitter account 
ICO Facebook account 
ICO LinkedIn account 
ICO website 

ICO newsletter 

ICO staff member 
Colleague 


X 00g 


Personal/work Twitter account 
Personal/work Facebook account 
Personal/work LinkedIn account 
Other 

If other please specify: 


Doo SE 


Thank you for taking the time to complete the survey 
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